1f778b612086d25904decc12c95fa87d7a18a51272372b678a2dfadd4f593357

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:56

Target

cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe
Size

594KB
MD5

cafdc98076941c6ece72b074279ed960
SHA1

690129fee529cdfa4a15ba51b7964c0dcee8b896
SHA256

1f778b612086d25904decc12c95fa87d7a18a51272372b678a2dfadd4f593357
SHA512

c468af8cc2699159d4b27a0b3d6f2110c4855773bc2229f7b3bc8ded21d554812a3772a62ef289e626472dd0cf21d941c255f288b1516d9e4bf2fc60288e3d34
SSDEEP

12288:UzTl4S0IM2JhsLR2FMwavsjlE2C7frJxSZwKhS8FBz1m5L1ho/9/3007HjPIqdxu:U10IMt2FMw8

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	3060	WerFault.exe	29

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 3060	2360	cafdc98076941c6ece72b074279ed960_NeikiAnalytics.exe	29
PID 3060 wrote to memory of 2928	3060	aspnet_regiis.exe	30
PID 3060 wrote to memory of 2928	3060	aspnet_regiis.exe	30
PID 3060 wrote to memory of 2928	3060	aspnet_regiis.exe	30
PID 3060 wrote to memory of 2928	3060	aspnet_regiis.exe	30

\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
408KB

MD5
c0fb73182990c34fce275ea46afc0a49

SHA1
8a9552fedde7a625c8f6b3e478d97328b0db2f14

SHA256
44a5b6d7212c4403311e50fbd302dcbd6877db3ca09213c2a56a8dc8b1f29989

SHA512
d786b7828d9a731bd9b3ccd6de095ebf74e97b306b70a90c89504fd0bcfdf2190eadd909b8c79384812ee79ca8178521783a9994dbc66e80d79ca5a11fcc4bbc

Download Submit
memory/2360-0-0x000000007481E000-0x000000007481F000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x0000000001260000-0x00000000012FA000-memory.dmp

Filesize
616KB

Download
memory/3060-10-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-7-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-8-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-18-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-16-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3060-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3060-12-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download